Arbitrary File Upload Vulnerability in PublicCMS
CVE-2024-40549

8.8HIGH

Key Information:

Vendor

Publiccms

Status
Publiccms
Vendor
CVE Published:
12 July 2024

What is CVE-2024-40549?

PublicCMS v4.0.202302.e contains a vulnerability in the /admin/cmsTemplate/savePlace component that permits arbitrary file uploads. This flaw can potentially allow attackers to upload specially crafted files, which may result in the execution of arbitrary code on the server. Proper validations and restrictions should be enforced to mitigate this risk and protect systems from unauthorized access or malicious activities.

References

https://gitee.com/sanluan/PublicCMS/issues/IAALNE

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.